Documentation
¶
Overview ¶
Package auth provides JWT generation/validation and role definitions for okpos.
Index ¶
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func ComparePasswords ¶
ComparePasswords returns nil if the plaintext password matches the hash.
func HashPassword ¶
HashPassword hashes a plaintext password using bcrypt.
func WithMinCost ¶
func WithMinCost() hashOption
WithMinCost sets bcrypt cost to the minimum (4). Use in tests and seed scripts to avoid slow hashing at high iteration counts.
Types ¶
type Auth ¶
type Auth struct {
// contains filtered or unexported fields
}
Auth holds the signing secret and token expiry used for all JWT operations.
func (*Auth) GenerateFileAccessJWT ¶
func (a *Auth) GenerateFileAccessJWT( fileID, companyID uuid.UUID, ttl time.Duration, ) (string, error)
GenerateFileAccessJWT issues a short-lived capability token scoped to a single file, used to build presigned download URLs for the local filesystem storage driver. It carries no user identity — CompanyID is included only so the download handler can reuse the same company-scoped repo lookup every other authenticated path uses.
func (*Auth) GenerateJWTPair ¶
func (a *Auth) GenerateJWTPair(payload *JWTPayload) (*JWTTokens, error)
GenerateJWTPair issues a new access + refresh token pair for the given payload.
type JWTClaims ¶
type JWTClaims struct {
UserID uuid.UUID `json:"user_id"`
Name string `json:"name"`
Email string `json:"email"`
Role UserRole `json:"role,omitempty"`
CompanyID *uuid.UUID `json:"company_id,omitempty"` // nil for owners
// FileID is set only on tokens with Subject == FileAccessTokenSubject —
// the single file this capability token grants download access to.
FileID *uuid.UUID `json:"file_id,omitempty"`
jwt.RegisteredClaims
}
JWTClaims are the claims embedded in every okpos JWT.
type JWTPayload ¶
type JWTPayload struct {
ID uuid.UUID
Name string
Email string
AuthID uuid.UUID
Role UserRole
CompanyID *uuid.UUID // nil for owners
}
JWTPayload is the input for generating JWT tokens.
type JWTTokens ¶
type JWTTokens struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
}
JWTTokens holds an access/refresh token pair returned after login or refresh.
type TokenSubject ¶
type TokenSubject string
TokenSubject identifies the purpose of a JWT.
const ( AccessTokenSubject TokenSubject = "okpos-access" RefreshTokenSubject TokenSubject = "okpos-refresh" // FileAccessTokenSubject identifies a short-lived, single-file capability // token used by the local filesystem storage driver's presigned download // URLs. Unlike access/refresh tokens it carries no user identity — anyone // holding the token can download the referenced file until it expires. FileAccessTokenSubject TokenSubject = "okpos-file" )
Source Files